Our website uses cookies to give you the best experience and for us to analyse our site usage. If you continue to use our site, we will take it you are OK about this. Click on More for information about the cookies on our site and what you can do to opt out.

Personal information is information about identifiable, living people.

Almost every person or organisation that holds personal information is an 'agency'. So, for example, the Privacy Act covers government departments, companies of all sizes, religious groups, schools and clubs.

Exemptions from the Act

Only a few organisations and people are not 'agencies'. Other rules exist to govern how they manage personal information, so the Privacy Act does not cover what they do. Organisations that aren't covered by the Privacy Act include:

Members of Parliament, when they are acting as MPs. It's up to Parliament or political parties to discipline MPs for breaches of privacy

courts and tribunals, in relation to their judicial functions. You have to challenge judicial decisions through the normal processes, such as an appeal

if another law is inconsistent with the Privacy Act, that other law will 'trump' the Privacy Act

individuals who collect or hold personal information for their own personal, family or household affairs are exempt -- although this ceases to apply once the personal information concerned is collected, disclosed, or used, if that collection, disclosure, or use would be highly offensive to an ordinary reasonable person.

in special circumstances, the Commissioner can authorise agencies to collect, use or disclose information even when that would usually breach principles 2, 10 or 11.

The privacy principlesAt the heart of the Privacy Act are twelve privacy principles. The privacy principles cover:

issuing codes of practice, which modify the privacy principles and which apply to a particular industry or topic

investigating complaints about interferences with privacy. An interference with privacy can occur when:

(a) an agency wrongfully refuses to give an individual access to information about them, or wrongfully refuses to correct information about them, or(b) an individual suffers some form of harm as a result of a breach of a privacy principle, rule, or a code of practice or information matching provision.

Contact usor if you have a complaint about privacy that you have not managed to resolve with the agency, you can make a formal complaint to us.